CVE-2021-22771
📋 TL;DR
This vulnerability allows attackers to execute arbitrary commands on Schneider Electric Easergy T300 devices by exploiting improper CSV formula element neutralization. Attackers could gain full control of affected devices running firmware V2.7.1 or older. This affects industrial control systems using these specific power management devices.
💻 Affected Systems
- Schneider Electric Easergy T300
📦 What is this software?
Easergy T300 Firmware by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to manipulate power management systems, disrupt operations, or use as pivot point into industrial networks.
Likely Case
Remote code execution leading to device configuration changes, data theft, or denial of service affecting power management functions.
If Mitigated
Limited impact with proper network segmentation and CSV file validation controls in place.
🎯 Exploit Status
Exploitation requires ability to upload CSV files to the device; authentication status depends on specific device configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware newer than V2.7.1
Vendor Advisory: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02
Restart Required: Yes
Instructions:
1. Download latest firmware from Schneider Electric portal. 2. Backup current configuration. 3. Apply firmware update via device management interface. 4. Restart device. 5. Verify firmware version.
🔧 Temporary Workarounds
Restrict CSV file uploads
allBlock or monitor CSV file uploads to the device management interface
Network segmentation
allIsolate Easergy T300 devices on separate VLAN with strict access controls
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Deploy application whitelisting to prevent unauthorized CSV processing
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or CLI; if version is V2.7.1 or older, device is vulnerable.Check Version:
Check via device web interface at System > About or via serial console connectionVerify Fix Applied:
Verify firmware version is newer than V2.7.1 and test CSV upload functionality with safe test files.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV file uploads
- Unexpected command execution events
- Firmware version changes
Network Indicators:
- CSV file transfers to device management interface
- Unexpected outbound connections from device
SIEM Query:
source="easergy-t300" AND (event="csv_upload" OR event="command_execution")